NIS2 early warning: the 24 hours and what follows

An essential or important entity that has a significant incident sends an early warning to its national CSIRT within 24 hours, an incident notification within 72, and a final report within a month. This page gives the rule from the legal text, then what Jira does by itself, then what Dueline does.

What NIS2 says

Article 23 of the NIS2 Directive (Directive (EU) 2022/2555) asks an entity to notify the CSIRT or the competent authority of a significant incident, from the time it becomes aware of it (Article 23(4)):

• Early warning: within 24 hours, saying whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact.
• Incident notification: within 72 hours, updating the early warning with an initial assessment of the incident, its severity and impact, and indicators of compromise where available. A trust service provider notifies within 24 hours.
• Intermediate report: when the CSIRT asks, with relevant status updates.
• Final report: one month after the notification, with a detailed description, the likely root cause, the mitigation and any cross-border impact. If the incident is still ongoing then, a progress report is due and the final report one month after the incident is handled.

NIS2 is a directive: each country’s law sets the final rules and may be stricter. Whether an incident is significant is your assessment.

What Jira does by itself

Jira holds the incident as a work item, and Jira Service Management can run incidents and service level goals. A Due date in Jira is a date without a time, so it cannot say “24 hours from 03:15”, and a goal does not know that the final report runs from the notification, or from the handling of an incident that is still ongoing.

What Dueline does

Dueline is our app. Qualify asks when you became aware of the incident and whether it is a significant one under NIS2, and lists the early warning with its 24 hours, the notification with its 72 (24 for a trust service provider, as set in the settings), the intermediate report on request and the final report. The final report’s deadline starts when you record the notification as sent; if the incident is still ongoing a month later, Dueline lists the progress report and waits for you to record the incident as handled.

You send each report to the CSIRT yourself and record it. Dueline sends nothing, and the assessment is yours. Work the dates out with the free deadline calculator, and read How deadlines are counted, or follow Read the deadlines on a work item.

See also DORA incident reporting. Back to Dueline.